Comment by hpone91
10 hours ago
Yeah, the specific setup is not vulnerable to PHP2SHELL. CLI server + 1 MiB cap + inert page + high memory limit removes all the possibilities from the two CVEs. It would just be collecting POCs for actually vulnerable setups.
Should be the top comment IMO.
I'm just an interested bystander, but this seems like a (near?) default nginx config. Is that accurate?
Inert files are unrealistic, normally you use PHP server to execute PHP code, which this website doesn't appear to do (only static files). And suppose you want to accept >1mb file uploads, that limit would get in your way. So it's not a good representation of a PHP application, but for other uses it's reasonable.
So why did the original warning put out by the PHP team say that the exploit didn't rely on the application code and simply having software like Apache mod_php running would be enough?
https://www.php.net/archive/2026.php#2026-10-21-5
2 replies →
What advantage would that give an attacker here?